1 Introduction

This project delves into analyzing ransomware infections using data extracted from the Shodan API. By analyzing real-time data on internet-connected devices, we explore ransomware trends across various countries and cities. Through data visualizations and statistical analysis, we aim to identify geographic hotspots of ransomware activity, comprehend infection patterns, and provide valuable insights for cybersecurity professionals. The project underscores the importance of monitoring and comprehending ransomware incidents to enhance global cyber defenses.

1.1 Shodan API Overview

The Shodan API, a powerful tool for searching and retrieving data on internet-connected devices, provides information about devices’ locations, services, vulnerabilities, and more. In this project, the API is used to analyze global trends and patterns of ransomware infections.

2 Data Analysis of Ransomware Infections

This section analyzes ransomware infections. It starts with a summary of affected countries and reported incidents. A statistical analysis presents key metrics on infection distribution. The section concludes with a table detailing ransomware incidents by country and city, revealing geographic trends and high-infection areas.

2.1 Ransomware Infections Summary

According to the Shodan dataset, a total of 108 ransomware infections have been reported worldwide, impacting 37 countries. The countries with the highest number of ransomware infections are Brazil, Germany, each reporting 11 incidents.

The cities with the most ransomware infections are Frankfurt am Main, each with 6 incidents.

2.1.1 Statistical Analysis

  • The average number of ransomware infections per country is 2.92.
  • The median number of ransomware infections per country is 1.
  • The standard deviation of ransomware infections per country is 3.08.

2.2 Table of Ransomware Infections by Country and City

This comprehensive table offers a detailed breakdown of ransomware infection rates across various countries and cities. It presents country and city names alongside the corresponding number of ransomware incidents, making it easy to compare regions. This table serves as a crucial reference point for understanding global ransomware trends and identifying areas where cyber defenses may need reinforcement.

Distribution of Ransomware Infections by Country and City
Country City Number of Infections
940 Germany Frankfurt am Main 6
1951 Russian Federation Moscow 5
2305 Czechia Prague 3
2595 Brazil São Paulo 3
2636 China Shanghai 3
2944 Mexico Villahermosa 3
477 Turkey Bursa 2
829 Germany Düsseldorf 2
1219 United States Herndon 2
1365 Turkey Istanbul 2
2050 Germany Nürnberg 2
2574 Mexico Santiago de Querétaro 2
2673 China Shenzhen 2
16 Ghana Accra 1
56 Kazakhstan Almaty 1
109 United States Altamonte Springs 1
116 Brazil Aracruz 1
153 Brazil Araranguá 1
220 United States Ashburn 1
241 Kazakhstan Astana 1
290 Spain Barcelona 1
305 China Beijing 1
338 Brazil Boa Esperança 1
384 France Bourg-en-Bresse 1
411 Belarus Brest 1
493 Egypt Cairo 1
525 Canada Calgary 1
564 China Chengdu 1
614 Moldova, Republic of Chisinau 1
638 China Chongqing 1
667 Argentina Comodoro Rivadavia 1
713 Colombia Cúcuta 1
775 United States Des Moines 1
780 Bangladesh Dhaka 1
866 Germany Falkenstein 1
897 China Foshan 1
963 Argentina Godoy Cruz 1
1004 Brazil Goiânia 1
1053 India Gurugram 1
1074 Argentina Haedo 1
1147 Viet Nam Hanoi 1
1160 Finland Helsinki 1
1258 Viet Nam Ho Chi Minh City 1
1275 India Hyderābād 1
1319 Pakistan Islamabad 1
1374 Brazil Itajaí 1
1436 South Africa Johannesburg 1
1475 Taiwan Kaohsiung 1
1497 India Kolkata 1
1551 Ukraine Kyiv 1
1577 Nigeria Lagos 1
1626 United States Lee’s Summit 1
1654 Peru Lima 1
1696 Spain Madrid 1
1735 Turkey Maltepe 1
1741 Bahrain Manama 1
1781 Brazil Manaus 1
1823 Colombia Manizales 1
1860 Colombia Medellín 1
1922 United States Mercerville 1
1978 India Mumbai 1
2019 Mexico Nuevo Laredo 1
2093 Mexico Ojuelos de Jalisco 1
2127 Japan Osaka 1
2157 Czechia Ostrava 1
2208 Panama Panamá 1
2245 Panama Panama City 1
2278 Mexico Piedras Negras 1
2352 Mexico Puebla 1
2392 Pakistan Rawalpindi 1
2410 Brazil Rio de Janeiro 1
2469 Russian Federation Saint Petersburg 1
2514 United States Santa Fe Springs 1
2524 Chile Santiago 1
2707 Bulgaria Sofia 1
2773 United States Tacoma 1
2811 Uzbekistan Tashkent 1
2817 Brazil Toledo 1
2880 Spain Tortosa 1
2887 Argentina Villa Sarmiento 1
2991 Spain Villanueva de la Cañada 1
3017 Lithuania Vilnius 1
3063 Singapore Woodlands 1
3099 Serbia Zrenjanin 1

3 Data Visualization of Ransomware Infections

This section visualizes ransomware infection patterns globally. It maps incidents at country and city levels using Shodan API data, highlighting affected regions and trends. An interactive map lets users zoom in and examine infection details, making it useful for cybersecurity professionals and researchers.

3.1 Exploring Ransomware Hotspots

This data visualization explores the global distribution of ransomware infections, focusing on the geographical hotspots by country and city. Using data from the Shodan API, the map highlights areas with the highest concentrations of ransomware incidents, shedding light on trends and patterns in cyberattacks. By mapping ransomware infections based on real-time data, the visualization provides insights into which regions are most affected and allows for a better understanding of the geographic spread of these cyber threats. The interactive map enables users to zoom in on specific locations and view detailed information on the number of incidents, cities, and countries impacted, offering valuable insights for cybersecurity professionals and researchers.